0

I have an issue where I can't SSH into to switch due to a connection refused fatal error after a switch rebooted. One of the rsa key that is in the switch that I think is used in the switch is :

Key name: TP-self-signed-1041218253
Key type: RSA KEYS
 Storage Device: Synced from active
 Usage: General Purpose Key
 Key is not exportable.
 Key Data:
  30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
  00CFB83D 8CE939A5 CD64154E D15CB09F E2765E44 72F497AD B40A337F 78E8001A
  05D744D8 0CDB27F2 2681742F 4A52D3A5 6DE59536 1C2743AD EBB9D293 33D51F95
  69D188F1 8134BB4E 05370D64 BC7A53DE 7A8FADFF 5DCFE50B D7649745 E3637402
  F8E42510 413AC0CC BA2069A7 78594D7F 74B4FADA 7098C75B A66BD439 3CD3B5AF
  967BB604 07B0203F FF0B8244 4D3BF913 F7A53F92 812138BA E57DDCCC 7B6D641F
  F40141EB 8C0140E6 F56D2911 C304A295 BF6B1193 B1745E82 439A864D F7B1B6CE
  9C066A4D 94736286 53FDAA9E A0C486D4 7DAEFD9B D5F82497 ABBE9044 A23D7C49
  89403917 36D3AAA2 3E7D5113 E5F78A78 8D735B90 95BD1CF6 E81D269D B6803CB1
  03020301 0001

I do not want to zeroize the keys as there are multiple keys in there but I'm not sure what to do at this point. Should I input the command ip ssh rsa keypair-name xxx or try to generate new keys? But I heard that there is a process to regenerate keys if you already have active keys in the switch?

Improve this question
6
  • can you provide us with an output of sh ip ssh? If this shows as "Disabled" then maybe keys are corrupted or it never worked(?). To fix "Disabled" generate RSA with a length of at least 768 (but I would recommend 2048).
    – kubn2
    Apr 30, 2021 at 21:03
  • Yes it is showing as disabled. Before I generate a new key, I was wondering: the running config currently has all of the vty info in it (since it definitely was working before the reboot), will I have to input all if these info again with the new key? Or is there a command to just use the newly generated key with the SSH? I cant just erase all of the keys and start fresh because there are other keys currently in the switch.
    – John
    Apr 30, 2021 at 21:30
  • Also, what commands can I use to determine what key is being used for SSH in a switch currently?
    – John
    Apr 30, 2021 at 21:30
  • You don't have to put any config in vty after generating a new key since the correct config is already there. Keys that are generated/replaced during "crypto key generate rsa" are not visible in the config and it's not named as TP-self-signed-XXXX. The one that you see is result of command "ip http secure-server". If you would like to check your ssh keys then use "sh crypto key mypubkey rsa" and look for keys that have name: hostname.domain-name and hostname.domain-name.server
    – kubn2
    May 1, 2021 at 16:57
  • Okay, Thank you. If I already have the key listed in sh crypto key mypubkey rsa if I want to link that key for ssh, do I use the ip ssh rsa keypair-name xxx or ip ssh rsa keypair-name xxx.server command?
    – John
    May 3, 2021 at 1:09

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.